The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted content from the local environment which could contain malicious instructions designed to influence the review outcome or the fixes applied.
Ingestion points: File SKILL.md (Step 1) defines the scope to include staged/unstaged changes, commits ahead of upstream, and branch diffs.
Boundary markers: The instructions do not specify the use of delimiters or clear instructions to the sub-agents to ignore embedded natural language commands within the code being reviewed.
Capability inventory: The skill uses spawn-agent to create new sessions, performs file writes during the Fix stage (Step 6), and executes shell commands for unidentified harnesses.
Sanitization: There is no mention of filtering or sanitizing the ingested code before it is passed to the reviewer 'voices'.
[COMMAND_EXECUTION]: The skill instructs the agent to execute arbitrary command-line tools based on user input or missing pre-configurations.
Evidence: SKILL.md states: "For a harness spawn-agent has no reference for, run a headless CLI session by that harness's own conventions".
[DYNAMIC_EXECUTION]: The agent is tasked with determining how to execute external tools at runtime by inspecting their help documentation.
Evidence: In SKILL.md, the agent is told that for unknown harnesses, "its --help is the source of truth" for determining execution patterns.

review-panel